#!/bin/bash

sudo cp -v ./etc/keyd/keyd.conf /etc/keyd/
sudo cp -v ./etc/pacman.conf /etc/
sudo cp -v ./etc/kernel/cmdline /etc/kernel/
sudo cp -v ./etc/modprobe.d/blacklist-security.conf /etc/modprobe.d/
sudo cp -v ./etc/pam.d/system-local-login /etc/pam.d/
sudo cp -v ./etc/pam.d/system-login /etc/pam.d/
sudo cp -v ./etc/pam.d/greetd /etc/pam.d/
sudo cp -v ./etc/login.defs /etc/
sudo cp -v ./etc/updatedb.conf /etc/
sudo cp -v ./etc/sudoers.d/00-hardening /etc/sudoers.d/
sudo cp -v ./etc/systemd/coredump.conf /etc/systemd/
sudo cp -v ./etc/sysctl.d/99-security.conf /etc/sysctl.d/
sudo cp -v ./etc/cups/cupsd.conf /etc/cups/

grep tmpfs /etc/fstab || sudo cat ./etc/fstab >> /etc/fstab

# firewall
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw default deny routed
sudo ufw limit ssh
sudo ufw allow from 192.168.1.0/24 to any port 8080 proto tcp
sudo ufw logging low
sudo ufw enable
sudo systemctl enable --now ufw

# fail2ban
sudo cp -v ./etc/fail2ban/jail.d/sshd.conf /etc/fail2ban/jail.d/

# linux presets
sudo cp -v ./etc/mkinitcpio.d/linux-hardened.preset /etc/mkinitcpio.d
sudo cp -v ./etc/mkinitcpio.d/linux-lts.preset /etc/mkinitcpio.d
sudo cp -v ./etc/mkinitcpio.d/linux.preset /etc/mkinitcpio.d

# harden systemd services
echo "==> Creating drop-in override directories..."
sudo mkdir -p /etc/systemd/system/sshd.service.d
sudo mkdir -p /etc/systemd/system/fail2ban.service.d
sudo mkdir -p /etc/systemd/system/cups.service.d

echo "==> Applying sshd.service hardening..."
sudo cp -v ./etc/systemd/system/sshd.service.d/override.conf /etc/systemd/system/sshd.service.d/

echo "==> Applying fail2ban.service hardening..."
sudo cp -v ./etc/systemd/system/fail2ban.service.d/override.conf /etc/systemd/system/fail2ban.service.d/

echo "==> Applying cups.service hardening..."
sudo cp -v ./etc/systemd/system/cups.service.d/override.conf /etc/systemd/system/cups.service.d/

sudo mkdir -p /var/log/cups
sudo chown root:lp /var/log/cups
sudo chmod 755 /var/log/cups